gitlab.com/phpboyscout/go/redact redacts credential-like content from free-form strings at the boundary between trusted and untrusted observability surfaces — telemetry vendors, log aggregators, metric stores. Error messages, command arguments, and HTTP header values routinely carry secrets by accident (a URL with embedded userinfo, an --api-key=sk-… flag in os.Args, an Authorization header quoted in an export error). Route those through redact.String on the way out and they never leave the process in the clear.

Design

• Zero dependencies. Pure standard library (regexp, strings) — nothing but the module enters your graph. A depfootprint_test.go guard enforces it.
• Boundary redaction. Sanitise where data leaves the host, not everywhere.
• Conservative by default. The opaque-token fallback requires ≥41 chars so it never false-positives on UUIDs, MD5, or SHA-1.

Install

go get gitlab.com/phpboyscout/go/redact

Usage

import "gitlab.com/phpboyscout/go/redact"

safe := redact.String("failed calling https://user:[email protected]?api_key=sk-abc123…")
// → credentials in the URL userinfo, the api_key query param, and the sk- token are masked

msg := redact.Error(err) // redact.String applied to err.Error() (nil-safe)

if redact.IsSensitiveHeaderKey("Authorization") { /* … redact this header's value … */ }

redact.String strips URL userinfo for any scheme (https://, postgres://, redis://, …), credential name=value assignments, JSON credential fields such as "access_token" and "client_secret", Authorization-header tokens, JWTs, well-known provider prefixes (sk-, ghp_, glpat-, AIza, AKIA, Slack), and long opaque tokens. SensitiveHeaderKeys / IsSensitiveHeaderKey identify headers whose values should be redacted.

Limitations

Pattern catalogues never reach 100% recall, and this one is deliberately conservative:

• No configuration. You cannot add, disable or reorder a pattern — the package exports four symbols and nothing to tune. Compose around it instead.
• String does not mask arbitrary header values. It knows Authorization: and nothing else; X-API-Key: … passes through. That is what the header symbols are for.
• Bespoke and short secrets slip through. The catch-all fallback needs 41 characters, and each provider prefix has a hard minimum length.
• Patterns are ASCII-only, and redaction is one-way — nothing to reverse and no record of what was replaced.

What redact does not do states the full boundary.

Documentation

Full guides, reference and threat model: redact.go.phpboyscout.uk. Generated API docs and runnable examples: pkg.go.dev.

License

See LICENSE.